Packet-based data networks continue to grow in importance, and it is often desirable to monitor network traffic associated with these packet-based networks on an ongoing basis. To meet these monitoring needs, copies of network packets can be forwarded to diagnostic network monitoring tools. Packets are often forwarded using network hubs, test access ports (TAPs), and/or switched port analyzer (SPAN) ports available on network switch systems. For example, certain network switch systems produced by Cisco Systems include SPAN ports to which traffic on the switches are mirrored. It is also noted that other packet monitoring or access methods may also be used to acquire copies of network packets being communicated within a network infrastructure.
To help alleviate the problem of limited access to network packets for monitoring, tool aggregation devices or packet broker devices have been developed that allow shared access to the monitored network packets. These tool aggregation devices allow users to obtain packets from one or more network monitoring points (e.g., network hub, TAP, SPAN port, etc.) and to forward them to different network monitoring tools. U.S. Pat. No. 8,018,943, U.S. Pat. No. 8,098,677, and U.S. Pat. No. 8,934,495 describe example embodiments for network tool optimizer systems that provide packet forwarding systems for tool aggregation and packet broker solutions and describe in part configuration of user-define filters, automatic creation of filter engine forwarding rules, automatic handling of filter overlaps, graphical user interfaces (GUIs) for filter creation, and other features. U.S. Pat. No. 8,018,943, U.S. Pat. No. 8,098,677, and U.S. Pat. No. 8,934,495 are each hereby incorporated by reference in its entirety.
Packet forwarding systems often allow filtering of packets and related forwarding actions to be based upon specific packet data criteria (e.g., at least one criterion related to the packet) to pass or deny network communication traffic from input ports to output ports. For example, Pass by Criteria (PBC) filters can be used to pass only input packets matching selected criteria from input ports to output ports, and Deny by Criteria (DBC) filters can be used to pass only input packets not matching selected criteria from input ports to output ports. Thus, packets that match such PBC filters or do not match such DBC filters are passed to output ports and ultimately to destination devices, such as network monitoring tools, connected to these output ports. Packets that are not passed by such criteria-based filters are dropped.